diff --git a/.forgejo/workflows/images.yml b/.forgejo/workflows/images.yml
index 0306fee..272db9c 100644
--- a/.forgejo/workflows/images.yml
+++ b/.forgejo/workflows/images.yml
@@ -1,57 +1,44 @@
 name: Build (and tag) Images
 
 on:
-  push:
-  workflow_dispatch:
+  workflow_dispatch: {}
+  push: {}
+
+# Every push builds both images. Only pushes to the main branch publish them, as
+# `latest` and `sha-<commit>`; all other refs build without pushing and do not
+# receive registry credentials.
 
 jobs:
-  build:
-    runs-on: windows-2022
+  build-container:
+    name: Build ${{ matrix.image }} Image
+    runs-on: docker
+    container:
+      image: ghcr.io/osscontainertools/kaniko:alpine
+    strategy:
+      matrix:
+        image:
+          - web
+          - data_handler
     steps:
-      - name: Checkout repository
+      - name: Install required system packages
+        run: apk add --no-cache nodejs git
+
+      - name: Checkout source code
         uses: actions/checkout@v7
 
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
-
-      - name: Login to Container Registry
-        uses: docker/login-action@v4
-        with:
-          registry: git.hamburg.ccc.de
-          username: ${{ secrets.REGISTRY_USERNAME }}
-          password: ${{ secrets.REGISTRY_TOKEN }}
-      
-      - name: Set image tags
-        id: vars
-        run: |
-          if [ "${{ github.ref_name }}" = "main" ] && [ "${{ github.event_name }}" = "push" ]; then
-            echo "tag=latest" >> $GITHUB_OUTPUT
-          else
-            # renovate creates sub branches with `/`; these break the tagging in the build process
-            echo tag=$(echo "${{ github.ref_name }}" | sed 's/[^a-zA-Z0-9._-]/_/g') >> $GITHUB_OUTPUT
-          fi
-
-      - name: Build web image
-        run: |
-          docker buildx build -f ./Containerfile -t git.hamburg.ccc.de/ccchh/sunders/web:${{ steps.vars.outputs.tag }} --load .
-        working-directory: ./web
-
-      - name: Build data_handler image
-        run: |
-          docker buildx build -f ./Containerfile -t git.hamburg.ccc.de/ccchh/sunders/data_handler:${{ steps.vars.outputs.tag }} --load .
-        working-directory: ./data_handler
-
-      - name: Push images to Container Registry
-        run: |
-          docker push git.hamburg.ccc.de/ccchh/sunders/web:${{ steps.vars.outputs.tag }}
-          docker push git.hamburg.ccc.de/ccchh/sunders/data_handler:${{ steps.vars.outputs.tag }}
-        if: github.event_name == 'push'
-
-      - name: Update docker-compose.yml image tags
-        run: |
-          sed -i "s/:latest/:${{ steps.vars.outputs.tag }}/g" docker-compose.yml
-
-      - name: Start Docker Compose services
-        run: |
-          docker compose up -d --wait
-          docker compose down 
\ No newline at end of file
+      - name: Build image
+        env:
+          KANIKO_NO_PUSH: ${{ !(forgejo.event_name == 'push' && forgejo.ref == 'refs/heads/main') }}
+          KANIKO_GIT_HAMBURG_CCC_DE_USER: forgejo-actions
+          KANIKO_GIT_HAMBURG_CCC_DE_PASSWORD: ${{ (forgejo.event_name == 'push' && forgejo.ref == 'refs/heads/main') && secrets.PACKAGES_TOKEN || '' }}
+        run: /kaniko/executor
+          --dockerfile="${{ forgejo.workspace }}/${{ matrix.image }}/Containerfile"
+          --context="dir://${{ forgejo.workspace }}/${{ matrix.image }}"
+          --destination=git.hamburg.ccc.de/ccchh/sunders/${{ matrix.image }}:latest
+          --destination=git.hamburg.ccc.de/ccchh/sunders/${{ matrix.image }}:sha-${{ forgejo.sha }}
+          --no-push-cache
+          --credential-helpers=env
+          --annotation=org.opencontainers.image.ref.name=sunders/${{ matrix.image }}
+          --annotation=org.opencontainers.image.revision=${{ forgejo.sha }}
+          --annotation=org.opencontainers.image.url=${{ forgejo.server_url }}/${{ forgejo.repository }}
+          --annotation=org.opencontainers.image.source=${{ forgejo.server_url }}/${{ forgejo.repository }}